Critical/High Security Vulnerabilities in Bit BVM Installation (Version 1.8.20)

[harinlee0803]

I am encountering critical/high upstream security vulnerabilities in the latest version of Bit (v1.8.20) when using it in a self-hosted GitHub runner. The runner is based on a container image that installs Bit using the following command:

RUN npx @teambit/bvm install 1.8.20

After building and pushing the image to AWS ECR, AWS Inspector flagged multiple critical and high-severity vulnerabilities that appear to be coming from Bit's dependencies. Here’s a list of vulnerabilities identified:

Critical Severity:

• CVE-2022-0686 - url-parse
• CVE-2024-42461 - elliptic
• MAL-2022-4691 - monorepo-symlink-test
• CVE-2021-3757 - immer
• CVE-2021-42740 - shell-quote
• CVE-2021-23436 - immer
• CVE-2021-24044 - hermes-engine
• GMS-2020-2 - execa
• CVE-2022-37601 - loader-utils
• CVE-2021-24037 - hermes-engine
• CVE-2021-3918 - json-schema
• CVE-2022-0691 - url-parse
• CVE-2022-29078 - ejs

High Severity:

• CVE-2020-1915 - hermes-engine
• CVE-2021-43138 - async
• CVE-2022-25647 - gson
• CVE-2021-23326 - graphql-tools
• CVE-2022-3517 - minimatch
• CVE-2021-23337 - lodash
• GHSA-qm7x-rc44-rrqw - apollo-server
• CVE-2022-24999 - qs
• CVE-2021-3807 - ansi-regex
• CVE-2022-24434 - dicer
• CVE-2020-8203 - lodash.pick
• CVE-2022-37603 - loader-utils

Is there a plan to address these security issues in an upcoming release? Alternatively, is there a recommended approach for mitigating these vulnerabilities when using the Bit BVM installation?

[itaymendel]

hi,

bvm does not impact the application runtime not is actually used for a bit-server or a container. bvm is a tool that simplifies the installation of bit, so all these dependencies do not cause any impact on your infrastructure.

for your issue, we actually have a set of docker containers that have bit per-installed, so you do not have this impact at all - https://hub.docker.com/r/bitsrc/stable/tags

we are updating dependencies in bvm from time to time, to ensure warnings disappear, but as for this ticket - i prefer to close it, as it takes focus away from tickets that impact people who use bit.

[GiladShoham]

bvm 1.0.5 was just published The bvm package itself is now clean in terms of security issues.